When I run this search:
index=_internal clientip=* host="My-SearchHead" sourcetype=splunk_web_access | dedup user | table user clientip host
I get this result:
user clientip host
MyUser 127.0.0.1 My-SaerchHead
All the users have the same IP.
Anyone know why this is and how I can change it?
There is probably nothing that you can (or at least you nothing that you should) do about it; it is an indication that Splunk is using loopback to process the user session on the search head. What you can do is get rid if the host=My-SearchHead
part and you may see other hosts (if you are using Search Head Pooling, etc.). You can also use dnslookup
to translate the host (name) to IP address like this:
index=_internal clientip=* sourcetype=splunk_web_access | table user clientip host | dnslookup forward host ip
If you are trying to see what IP addresses are connecting to your search head, you will have to use another method.
thanks Much @woodcock for the response. this is an adaptation of a search in the "SplunkApp:Utilization Monitor for Splunk" All users from all splunk systems that are running the web interface are showing the loopback address. Do you. Using the dnslookup i don't think will yearly anything since it is showing the loopback IP.
You misunderstand; the dnslookup is on the host, which is your Search Head name, of which there may be many if you are in a cluster or pool, and will return the IP address for each one, not for the loopback IP.